Linux Application-to-Application (A2A) connection status displays as yellow

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

In Symantec Privileged Access Manager (PAM), the A2A client's Connection Status may display as yellow, preventing users from running scripts on the affected client servers. While restarting the client service might offer a temporary workaround, the underlying issue persists.

During this time, the following error may be observed in the A2A client log (accessible via Credentials > Manage A2A > Clients > > Get Logs

WARNING: Fri May 18 10:17:41.515 EDT 2018 CSPMService::doPost. Failed to process event: UNKNOWN, exception: null
[Fatal Error] :1:1: Content is not allowed in prolog.
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; Content is not allowed in prolog.

Environment

 

• Product: Symantec Privileged Access Manager (PAM)

• Component: Application-to-Application (A2A) Client

• Versions: 4.1.X and later

 

Resolution

Perform the following troubleshooting steps:

Step 1: Verify Network Port Connectivity Ensure that TCP ports 28088 and 28888 are open and allow traffic between the A2A client server and the PAM appliance.

Step 2: Update the Client Key

1. Log in to the PAM UI.

2. Navigate to Credentials > Manage A2A > Clients.

3. Double-click the affected client to open its properties.

4. Click the Change Key button.

Step 3: Clear the Client Cache File If updating the key does not resolve the connectivity issue, clear the client's local cache:

1. Stop the A2A client:

   $CSPM_CLIENT_HOME/cspmclient/bin/cspmclientd stop
   

2. Delete the cache file (if it exists):

   $CSPM_CLIENT_HOME/cspmclient/config/data/.cspmclient.dat
   

3. Deactivate the A2A client within the PAM UI:

   • Navigate to Devices > Manage Devices.

   • Select the target device.

   • Uncheck the Active checkbox and save.

4. Restart the A2A client:

   $CSPM_CLIENT_HOME/cspmclient/bin/cspmclientd start
   

5. Reactivate the A2A client in the PAM UI by navigating back to the device and checking the Active checkbox.

Additional Information

 

• DNS Configuration: This issue can occur in environments where the DNS lookup returns a primary IP alongside multiple other IP addresses. Ensuring the client registers with a correctly routing IP address will allow A2A to connect properly and return the status to green. Confirm that your DNS resolves correctly to the PAM appliance.

• Authorization Mappings: Validate and update the A2A Auth mappings in the PAM UI as required by your environment's security policies.